{"id":4679,"date":"2025-11-01T17:35:28","date_gmt":"2025-11-01T17:35:28","guid":{"rendered":"https:\/\/geekmungus.co.uk\/?p=4679"},"modified":"2025-11-01T17:35:57","modified_gmt":"2025-11-01T17:35:57","slug":"palo-alto-firewall-vpn-status-monitoring-via-rest-api","status":"publish","type":"post","link":"https:\/\/geekmungus.co.uk\/?p=4679","title":{"rendered":"Palo Alto Firewall &#8211; VPN Status Monitoring via REST API"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A plugin has been developed to allow the monitoring of the status of VPN Tunnels on the Palo Alto Firewall.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The script uses the Palo Alto Firewall API to access the relevant part of the API &#8220;tree&#8221; to find the status of the VPN Tunnel(s).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can find the current version of the plugin here:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/tristanhself\/general\/blob\/master\/check_pa_vpn_status.py\">https:\/\/github.com\/tristanhself\/general\/blob\/master\/check_pa_vpn_status.py<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Using the script is fairly straightforward, you will need to have a suitable API key to give access to the Palo Alto Firewall API, then you&#8217;ll need to determine the name of the IPSec VPN Tunnel you wish to monitor.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"PaloAltoFirewallVPNStatusMonitoringviaRESTAPI-Authentication\">Authentication<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">You first need to retrieve an API key, you may also need to create a special read only account for this purpose too.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"PaloAltoFirewallVPNStatusMonitoringviaRESTAPI-DetermineTunnelName\">Determine Tunnel Name<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">You&#8217;ll need to find the Tunnel Name you wish to monitor, you can do this from within the Palo Alto Firewall web interface&nbsp;<strong>Network \u2192 IPSec Tunnels<\/strong>, then find the tunnel by the name:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"451\" src=\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/11\/image-1024x451.png\" alt=\"\" class=\"wp-image-4681\" srcset=\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/11\/image-1024x451.png 1024w, https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/11\/image-300x132.png 300w, https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/11\/image-768x339.png 768w, https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/11\/image-1536x677.png 1536w, https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2025\/11\/image.png 1908w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Highlighted is an example IPSec VPN Tunnel name we wish to use, we&#8217;ll use this when it comes to demostrating the usage of the script, and its output.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"PaloAltoFirewallVPNStatusMonitoringviaRESTAPI-UsingtheScript\">Using the Script<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">To use the script, you&#8217;ll need to pass in some arguments at runtime. If you are calling the script from a monitoring software like NagiosXI, specify these within your &#8220;command&#8221; and argumentise the input values into $ARG1$, $ARG2$ and $ARG3$ for the URL, API Token and Tunnel Name respectively.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/check_pa_vpn_status.py -e &lt;URL to Firewall including \/api> -a \"&lt;API Token>\" -t &lt;Tunnel Name><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">With some real inputs:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.\/check_pa_vpn_status.py -e https:\/\/firewall1.domain.com\/api -a \"&lt;Secret API Key>\" -t vpn-tunnel-a<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">We&#8217;ll get an example output such as the following depending on if the IPSec VPN Tunnel is up or down:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>OK - IPSec VPN UP - vpn-tunnel-a tunnel.103 18.35.26.142.\n\nCRITICAL - IPSec VPN DOWN - vpn-tunnel-a tunnel.103 18.26.57.32<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If you enter an invalid tunnel name, API URL etc, the script will return UNKNOWN.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\" id=\"PaloAltoFirewallVPNStatusMonitoringviaRESTAPI-AdditionalInformation\">Additional Information<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/helpdesk.paessler.com\/en\/support\/solutions\/articles\/76000067482-palo-alto-network-vpn-monitoring-powershell-script\">https:\/\/helpdesk.paessler.com\/en\/support\/solutions\/articles\/76000067482-palo-alto-network-vpn-monitoring-powershell-script<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.paloaltonetworks.com\/pan-os\/11-0\/pan-os-panorama-api\/get-started-with-the-pan-os-xml-api\/enable-api-access\">https:\/\/docs.paloaltonetworks.com\/pan-os\/11-0\/pan-os-panorama-api\/get-started-with-the-pan-os-xml-api\/enable-api-access<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.paloaltonetworks.com\/pan-os\/11-0\/pan-os-panorama-api\/get-started-with-the-pan-os-xml-api\/get-your-api-key\">https:\/\/docs.paloaltonetworks.com\/pan-os\/11-0\/pan-os-panorama-api\/get-started-with-the-pan-os-xml-api\/get-your-api-key<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.paloaltonetworks.com\/pan-os\/11-0\/pan-os-panorama-api\/get-started-with-the-pan-os-xml-api\/authenticate-your-api-requests\">https:\/\/docs.paloaltonetworks.com\/pan-os\/11-0\/pan-os-panorama-api\/get-started-with-the-pan-os-xml-api\/authenticate-your-api-requests<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.paloaltonetworks.com\/pan-os\/11-0\/pan-os-panorama-api\/get-started-with-the-pan-os-xml-api\/make-your-first-api-call\">https:\/\/docs.paloaltonetworks.com\/pan-os\/11-0\/pan-os-panorama-api\/get-started-with-the-pan-os-xml-api\/make-your-first-api-call<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/docs.paloaltonetworks.com\/pan-os\/11-0\/pan-os-panorama-api\/get-started-with-the-pan-os-xml-api\/explore-the-api\">https:\/\/docs.paloaltonetworks.com\/pan-os\/11-0\/pan-os-panorama-api\/get-started-with-the-pan-os-xml-api\/explore-the-api<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>A plugin has been developed to allow the monitoring of the status of VPN Tunnels on the Palo Alto Firewall. The script uses the Palo Alto Firewall API to access the relevant part of the API &#8220;tree&#8221; to find the status of the VPN Tunnel(s). You can find the current version of the plugin here: &#8230; <a title=\"Palo Alto Firewall &#8211; VPN Status Monitoring via REST API\" class=\"read-more\" href=\"https:\/\/geekmungus.co.uk\/?p=4679\" aria-label=\"Read more about Palo Alto Firewall &#8211; VPN Status Monitoring via REST API\">Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":4390,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,19,44],"tags":[],"class_list":["post-4679","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nagios-and-nagiosxi","category-palo-alto-firewall","category-python"],"_links":{"self":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4679"}],"version-history":[{"count":2,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4679\/revisions"}],"predecessor-version":[{"id":4682,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4679\/revisions\/4682"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/media\/4390"}],"wp:attachment":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}